Koozali.org: home of the SME Server

security problem?

seabro

security problem?
« on: February 26, 2006, 11:27:29 AM »
Hi,

My server was very slow so I ran netstat and I get the following.

Seems like lots of connections to my squid.  I typed '/etc/rc.s/init.d/squid stop' and they went away.

Should I be worried?

tcp        0      0 www.blablabla.co:squid 66.72.47.162:2249       SYN_RECV
tcp        0      0 www.blablabla.co:squid 59.56.122.232:3284      SYN_RECV
tcp        0      0 www.blablabla.co:squid 58.49.185.178:18436     SYN_RECV
tcp        0      0 www.blablabla.co:squid 66.36.231.31:3826       SYN_RECV
tcp        0      0 www.blablabla.co:squid 58.49.185.178:31750     SYN_RECV
tcp        0      0 www.blablabla.co:squid 66.36.231.31:2816       SYN_RECV
tcp        0      0 www.blablabla.co:squid 58.49.185.178:52740     SYN_RECV
tcp        0      0 www.blablabla.co:squid 216.91.59.230:54874     SYN_RECV
tcp        0      0 www.blablabla.co:squid 61.244.133.248:3665     SYN_RECV
tcp        0      0 www.blablabla.co:squid 61.244.133.248:3665     SYN_RECV
tcp        0      0 www.blablabla.co:squid 221.226.124.109:4146    SYN_RECV
tcp        0      0 www.blablabla.co:squid cm222-167-19-37.hk:4002 SYN_RECV
tcp        0      0 www.blablabla.co:squid ppp-71-129-207-107:3968 SYN_RECV
tcp        0      0 www.blablabla.co:squid 66.36.231.31:2669       SYN_RECV
tcp        0      0 www.blablabla.co:squid 216.91.59.238:52291
ESTABLISHED
tcp        0      1 www.blablabla.co:51546 172.183.141.228:4662    SYN_SENT
tcp        0      1 www.blablabla.co:squid 221.235.78.62:3497      FIN_WAIT1
tcp        0      0 www.blablabla.co:48350 oasn01b.247realmedi:www
ESTABLISHED
tcp        0   1024 www.blablabla.co:squid 58.Red-213-98-44.:61958
ESTABLISHED
tcp        0      1 www.blablabla.co:squid 61.243.176.38:58583     LAST_ACK
tcp        0      0 www.blablabla.co:51567 e1.member.vip.ukl.y:www
ESTABLISHED
tcp        0   1877 www.blablabla.co:squid 222.129.219.19:4346
ESTABLISHED
tcp        0   1085 www.blablabla.co:squid mo-71-50-31-134.dh:3428 LAST_ACK
tcp        0      1 www.blablabla.co:squid 61.243.176.38:61077     LAST_ACK
tcp        0      1 www.blablabla.co:squid 61.243.176.38:62132     LAST_ACK
tcp        0      0 www.blablabla.co:squid host178-230.pool8:21841
CLOSE_WAIT
tcp        0    630 www.blablabla.co:squid 61.243.176.38:63732     LAST_ACK
tcp        0      0 www.blablabla.co:squid host178-230.pool8:22801
CLOSE_WAIT
tcp        0      0 www.blablabla.co:squid 80.25.64.182:1985
CLOSE_WAIT
tcp        1   1505 www.blablabla.co:squid 61.243.176.38:62676     CLOSING
tcp        0      0 www.blablabla.co:squid host178-230.pool8:23345
CLOSE_WAIT


This is just a small extract of the netstat results.

Thanks,

---------------------------------------------------
Looking for Love?
www.cardiffpersonals.co.uk
---------------------------------------------------